Existing law requires the Office of Emergency Services to, as appropriate, perform a risk analysis of potential threats posed by the use of generative artificial intelligence to California's critical infrastructure, including those that could lead to mass casualty events. Existing law requires that risk analysis to be provided to the Governor, and, if appropriate, include recommendations reflecting changes to artificial intelligence technology, its applications, and risk management, including further private actions, administrative actions, and collaboration with the Legislature to guard against potential threats and vulnerabilities. This bill would require that recommendations in the risk analysis reflecting changes to artificial intelligence technology include agentic artificial intelligence, as defined. Existing law requires the Department of Technology to annually submit to certain legislative committees a report regarding a specified required comprehensive inventory of all high-risk automated decision systems that have been, or are being, used, developed, or procured by a state agency. Existing law defines "high-risk automated decision system" to mean an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice. This bill would further require the comprehensive inventory in the report to include agentic artificial intelligence that has been, or is being, used, developed, or procured by a state agency.
The Insurance Rate Reduction and Reform Act of 1988, an initiative measure enacted by Proposition 103, as approved by the voters at the November 8, 1988, statewide general election, prohibits specified insurance rates from being approved or remaining in effect that are excessive, inadequate, unfairly discriminatory, or otherwise in violation of the act. Under the act, rates and premiums for automobile insurance are determined based on specified factors, including the insured's driving safety record. Existing law authorizes the provisions of Proposition 103 to be amended by a statute that furthers the purposes of the act and is enacted by the Legislature with a 23 vote. This bill, the Consumer Driving Data Protection Act of 2026, would authorize a consumer to opt to use telematics to establish their driving record, thus amending Proposition 103. The bill would prohibit the use of telematics data for a purpose other than rating private passenger automobile insurance. The bill would require a rate application under which telematics would be used to establish an insured's driving record to include specified materials related to the insurer's telematics program. This bill would prohibit an insurer that uses telematics from taking specified actions, including conditioning eligibility for a discount upon participation in a telematics program, unless the discount is approved by the commissioner. The bill would also set forth written consent and privacy requirements for the collection and use of telematics data. The bill would authorize the commissioner to impose specified penalties for violations of the bill's provisions, including civil penalties and suspension of an insurer's telematics program. This bill would require an insurance provider or third-party vendor to take specified actions with respect to the telematics data, including immediately deleting the data once a rating has been assigned to the consumer and obtaining an express written or electronic signature of a consumer on a notice meeting specified conditions. The bill would additionally prohibit an insurance provider or third-party vendor from keeping the telematics data for longer than 6 months and collecting audio or visual recordings of the occupants of the vehicle or persons outside the vehicle, among other specified prohibitions. The bill would declare that its provisions further the purposes of Proposition 103. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
Existing law, the California Emergency Services Act, establishes the California Cybersecurity Integration Center within the Office of Emergency Services to serve as the central organizing hub of state government's cybersecurity activities and to coordinate information sharing with various entities. Existing law also requires the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and information, as prescribed. This bill would require, on or before July 1, 2026, an operator, defined as a state agency responsible for operating, managing, overseeing, or controlling access to critical infrastructure, that deploys a covered artificial intelligence (AI) system, as defined, to establish a human oversight mechanism that ensures a human monitors the system's operations in real time and reviews and approves any plan or action proposed by the covered AI system before execution, except as provided. The bill would require the Department of Technology to develop specialized training in AI safety protocols and risk management techniques to oversight personnel. The bill would require oversight personnel for an operator to conduct an annual assessment of its covered AI systems, as specified, and to submit a summary of the findings to the department. The bill would make findings and declarations related to its provisions. The bill would preclude disclosure of specified information by the office. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
Existing federal law, through copyright, provides authors of original works of authorship, as defined, with certain rights and protections. Existing federal law generally gives the owner of the copyright the right to reproduce the work in copies or phonorecords and the right to distribute copies or phonorecords of the work to the public. Existing federal law provides that sound recordings fixed before February 15, 1972, are not subject to copyright but are subject to similar rights and protections under the Classics Protection and Access Act. Existing law requires, before each time that a generative artificial intelligence system or service, as defined, or a substantial modification to a generative artificial intelligence system or service, released on or after January 1, 2022, is made available to Californians for use, regardless of whether the terms of that use include compensation, a developer of the system or service to post on the developer's internet website documentation, as specified, regarding the data used to train the generative artificial intelligence system or service. This bill would require a developer of a generative artificial intelligence model to make available on its internet website a mechanism allowing a rights owner to request information about the developer's use of the rights owner's covered materials that would allow the rights owner to provide the developer with, among other things, registration, preregistration, or index numbers for one or more covered materials. The bill would require a developer to document and retain any requests received from rights owners for a specified time period. The bill would, subject to specified exceptions, require a developer to, within 30 days of receiving that request from the rights owner, assess whether the developer used the rights owner's covered materials to develop the model and provide the rights owner with a list of covered materials, as specified. The bill would provide that each day following the 30-day period that a developer fails to provide a rights owner with that information constitutes a discrete violation. The bill would authorize a rights owner who complies with specified requirements for submitting a request that is not provided with information according to these provisions to bring, subject to a certain notice and cure opportunity, a civil action against the developer for specified relief. The bill would provide that its requirements do not apply to a model that meets certain criteria, including, among other things, being trained exclusively using data the developer makes publicly available at no cost to users. The bill would provide that it does not impose liability on a telecommunications service, information service, or cable service provider, as specified. The bill would define various terms for these purposes.
Existing law requires the State Department of Education, on or before January 1, 2024, to develop a plan to expand mental health instruction in California public schools. This bill would require the department, on or before January 1, 2028, to develop a plan to expand digital wellness instruction in California public schools, as provided.
Existing law requires, beginning on January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed, among other things, connected vehicle location access. For these purposes, existing law defines "connected vehicle service" to mean any capability, including through a software application that is designed to be operated on a mobile device, to remotely obtain data from, or send commands to, a vehicle, and "connected vehicle location access" to mean a type of connected vehicle service that allows a person, who is outside of a vehicle, to view or track the location of the vehicle, as specified. If a vehicle includes connected vehicle location access, existing law requires a covered provider, as defined, to provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. Existing law delays the operation of this requirement depending on whether the vehicle was manufactured prior to, or on or after, January 1, 2028. Unless otherwise provided, a violation of the Vehicle Code constitutes an infraction. This bill would, instead, limit the provisions above to specified vehicles with connected vehicle access. The bill would apply the requirement for a vehicle with connected vehicle service to indicate to a person inside the vehicle if connected vehicle location access is enabled to all vehicles beginning with the 2031 model year. The bill would make this requirement operative beginning with the 2031 model year, for 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible, and on or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible. By establishing a new duty on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. This bill would declare that it is to take effect immediately as an urgency statute.
The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines "digital financial asset" to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines "digital financial asset business activity" to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor. This bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institution's board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program. This bill would authorize the department to enforce its provisions with administrative and civil remedies, as specified. The Corporate Securities Law of 1968 generally regulates the offering and selling in this state of a security, as defined. This bill would define "security" to not include a staking reward, as defined. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law requires, among other things related to ensuring the safety of companion chatbots, an operator to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, as specified. This bill, the Preventing AI User Self Endangerment (PAUSE) Act, would require an operator to adopt and make publicly available a policy governing its protocol for identifying and responding to credible crisis expressions and, for each companion chatbot an operator makes available to users in this state, implement a system for monitoring and detecting credible crisis expressions in user conversations with companion chatbots. The bill would require, if the monitoring system detects a credible crisis expression, the operator to take certain actions, including commence a crisis interruption pause, as specified. The bill would define "credible crisis expression" to mean a statement by a user of a companion chatbot that reasonably indicates, as determined through contextual analysis rather than keyword detection alone, intent to harm the user or others. This bill would require an operator of a companion chatbot to document certain information related to credible crisis expressions and crisis interruption pauses and, beginning January 1, 2028, annually report that information to the Office of Suicide Prevention. The bill would provide for its enforcement, as specified.
Existing law requires a state agency or department that utilizes generative artificial intelligence (GenAI) to directly communicate with a person regarding government services and benefits to ensure that those communications include a disclaimer that indicates to the person that the communication was generated by GenAI, as specified, and information describing how a person may contact a human employee of the state agency or department. This bill would instead require that disclaimer when a state agency or department uses GenAI to directly communicate with the public and would define "directly communicate" to mean to use GenAI, instead of a natural person, to communicate directly with a specific member of the public or to communicate a general public announcement, as specified.
Existing law establishes various privacy protections relating to the collection, use, sale, or distribution of personal information, images, or video recordings, including restrictions relating to the retention, access, use, sale, or sharing of images or video recordings collected through the operation of an in-vehicle camera. This bill would prohibit a security surveillance company, as defined, from distributing, selling, or otherwise authorizing a third party to access, use, or distribute content obtained from a consumer's security surveillance system without first obtaining the express consent of the consumer and the adult residents of a residential rental property or upon receipt of an order of a court or arbitrator.
